Releases carry their source: oxy-VERSION-src.tar.gz, reproducible; haikuports recipes for oxy and oh written from release source tarballs (refs #157) 045340293dc7

        artifact "oxy-src.tar.gz" {

            path "/src/target/dist-flat/oxy-src.tar.gz"

        }

- **Releases carry their source (#157).** Each release now has `oxy-VERSION-src.tar.gz`, the source as released, reproducible (sorted, fixed times and owners, gzip without a timestamp), listed in SHA256SUMS, for packagers to fetch at a fixed checksum. `packaging/haikuports/make-recipe.py oxy|oh TARBALL VERSION` writes the haikuports recipe from it (oh's from OxygenHub's source tarball); the 0.8.0 recipe, which used the on-demand archive, is gone.

# oxy and oh on HaikuDepot

[haikuports](https://github.com/haikuports/haikuports) recipes for oxy

(`dev-vcs/oxy`) and OxygenHub's `oh` (`dev-vcs/oh`) are written by

`make-recipe.py` from a release's source tarball (oxygen#156, #157).

Each release's dist job attaches `NAME-VERSION-src.tar.gz`: the source as

released, reproducible (sorted, fixed times and owners, gzip without a

timestamp). oh's holds the oxygenhub tree with its subrepos inside, so it

builds alone. The recipe fetches it from the release's stable address,

`https://oxygenhub.io/andymccall/REPO/releases/download/vVERSION/NAME-VERSION-src.tar.gz`,

and every crates.io crate in its `Cargo.lock` as a source of its own with its

checksum, building offline as haikuports' other Rust recipes (ripgrep) do.

For a release (oxy shown; oh is the same with `oh` and `oxygenhub`):

curl -LO https://oxygenhub.io/andymccall/oxygen/releases/download/vX.Y.Z/oxy-X.Y.Z-src.tar.gz

python3 packaging/haikuports/make-recipe.py oxy oxy-X.Y.Z-src.tar.gz X.Y.Z > oxy-X.Y.Z.recipe

Test it on Haiku R1/beta6 with haikuports checked out and `haikuporter`

installed: copy the recipe to `haikuports/dev-vcs/oxy/` and run

`haikuporter --no-source-packages -j1 -y oxy`. Submit it as a pull request

to haikuports (`oxy: new recipe`, then `oxy: bump to X.Y.Z`).

zstd's hidden symbols break the link), which the recipe sets. oh's tests

pull in the hub, whose pipeline parser needs a newer Rust than HaikuPorts'

1.94, so its recipe tests `hub-api` only.

"""Write a haikuports recipe for oxy or oh (oxygen#156, #157) from a release's

source tarball, NAME-VERSION-src.tar.gz, as the release job attaches it: the

tarball itself from the release's stable download address, and every

crates.io crate in its Cargo.lock as a source of its own with its checksum,

vendored offline in BUILD() as haikuports' Rust recipes (ripgrep) do.

    make-recipe.py oxy|oh SRC_TARBALL VERSION > NAME-VERSION.recipe

"""

import hashlib

import sys

import tarfile

import tomllib

PORTS = {

    "oxy": {

        "repo": "oxygen",

        "package": "oxy",

        "summary": "A version control system of signed, commuting changes, with Git interop",

        "description": [

            "oxy is the command line of Oxygen, a version control system built on",

            "patch theory: changes commute, conflicts are recorded rather than blocking,",

            "every change can be signed, and a trust policy says who may move what. It",

            "imports and exports Git history, clones from OxygenHub and other Oxygen",

            "hosts, and keeps repositories on disk or in S3, GCS or Azure buckets.",

        ],

        "docs": "README.md LICENSE*",

        "test": "oxy-core",

    },

    "oh": {

        "repo": "oxygenhub",

        "package": "oh",

        "summary": "The command line of OxygenHub, the forge for Oxygen repositories",

        "description": [

            "oh talks to an OxygenHub (such as https://oxygenhub.io): issues, proposals",

            "and their reviews, releases, Flow runs, their logs and reports, and checks,",

            "from the terminal. It works alongside oxy, the Oxygen version control",

            "client.",

        ],

        "docs": "README.md LICENSE docs/oh.md",

        "test": "hub-api",

    },

}

name, tarball, version = sys.argv[1], sys.argv[2], sys.argv[3]

port = PORTS[name]

prefix = f"{port['repo']}-{version}"

with tarfile.open(tarball) as t:

    lock = tomllib.load(t.extractfile(f"{prefix}/Cargo.lock"))

crates = sorted(

    (p["name"], p["version"], p["checksum"])

    for p in lock["package"]

    if p.get("source", "").startswith("registry+")

)

sha = hashlib.sha256(open(tarball, "rb").read()).hexdigest()

w(f'SUMMARY="{port["summary"]}"')

w('DESCRIPTION="' + " \\\n".join(port["description"]) + '"')

w(f'HOMEPAGE="https://oxygenhub.io/andymccall/{port["repo"]}"')

w(f'SOURCE_URI="$HOMEPAGE/releases/download/v$portVersion/{name}-$portVersion-src.tar.gz"')

w(f'SOURCE_DIR="{port["repo"]}-$portVersion"')

for i, (crate, ver, ck) in enumerate(crates, start=2):

    w(f'SOURCE_URI_{i}="https://static.crates.io/crates/{crate}/{crate}-{ver}.crate"')

    w(f'SOURCE_FILENAME_{i}="{crate}-{ver}.tar.gz"')

w(f'''

	{name}$secondaryArchSuffix = $portVersion

	cmd:{name}

	haiku${{secondaryArchSuffix}}_devel

{{

	for i in $(seq 2 {last}); do

		cat <<-EOF >"$vendor/${{1##*/}}/.cargo-checksum.json"

		{{

		  "files": {{}}

		}}

	cargo build --release --frozen -p {port["package"]}

}}

{{

	install -v -m 755 ./target/release/{name} "$prefix"/bin

	install -v -m 644 {port["docs"]} "$docDir"

}}

{{

	cargo test --release --frozen -p {port["test"]}

}}''')

# The source as released (oxygen#157): the oxygen tree,

# under oxygen-VERSION/, for packagers (haikuports) to fetch from the

# release at a fixed checksum. Reproducible: sorted, fixed times and

# owners, gzip without a timestamp.

if [ -z "${ONLY:-}" ] || [[ src == $ONLY ]]; then

  echo "== src"

  tar --sort=name --mtime='1970-01-01 00:00:00Z' --owner=0 --group=0 --numeric-owner \

    --mode='u+rwX,go+rX,go-w' --exclude=./target --exclude=.oxy \

    --transform "s|^\.|oxygen-$VERSION|" -cf - . | gzip -9n >"$OUT/$BIN-$VERSION-src.tar.gz"

fi